Updating

Update with APT

Updating LiveShield is extremely simple, because we use APT.

Please run following commands as a root (or using sudo):

apt update
apt upgrade

This will update all system and LiveShield packages to the latest version. Follow instructions on screen if any additional steps are required.

Version checking

Starting with Manager 1.2.0, the web interface shows running component versions and warns when packages are outdated or incompatible. There is no separate settings page for this. Versions and update status are checked automatically while you use Manager.

Component versions

Running versions appear in the page footer on every screen:

M:1.2.0 | A:1.2.0 | W:1.1.0

• M - Manager package version

• A - connected Analyser version (shown only when Analyser is connected and version is known)

• W - lowest version among online Workers (shown only when at least one Worker is online)

The sidebar footer shows Analyser TCP connection state separately: Connected or Not Connected. This indicator reflects the socket connection, not whether the Analyser version is compatible.

Version strings are checked and refreshed on page refresh and connection status is refreshed automatically in the background.

Update recommended

When a running component is behind the latest package available from apt.liveshield.net, the sidebar shows a red Update recommended banner. Hover over it to see which components are outdated and the available version (for example, Manager: 1.1.4 → 1.2.0).

Manager checks its own version always. Analyser is checked only when connected. Each online Worker is checked individually. The comparison uses APT repository data, refreshed about once per hour.

This is informational only. LiveShield keeps working normally. To update, run apt update and apt upgrade as described above.

Minimum Analyser version

Manager 1.2.0 introduced a minimum Analyser version requirement. Manager 1.3.0 requires Analyser 1.3.1 or newer.

Manager and Analyser exchange statistics and configuration over a TCP protocol. The minimum version marks the oldest Analyser release that speaks a compatible protocol. Analysers below this version are treated as incompatible even if the TCP connection succeeds.

Note

An Analyser can show Connected in the sidebar while still being incompatible. Connection status and version compatibility are separate checks.

When the connected Analyser is below the minimum:

• Worker statistics stop updating in Manager (Workers appear offline)

• Configuration changes are not propagated to Analyser

• Apply Configuration in the sidebar is blocked with the message: Analyser version is too old, please update to vX.X.X or newer

The footer A: version turns red. The sidebar shows Update required instead of Update recommended, with a tooltip like Analyser: X.X.X (minimum: X.X.X).

Upgrade the Analyser package with APT and restart the Analyser service if needed. After reconnect, statistics and configuration propagation resume.

Manager version rejection

Starting with Analyser 1.2.0, it can reject an outdated Manager after the connection handshake. This is the reverse of the minimum Analyser check, the Analyser decides that the Manager version is too old.

When rejected, the operational impact is the same: no statistics, no configuration propagation, and licence updates are skipped until Manager is upgraded and reconnects.

The footer M: version turns red. The sidebar shows Update required with a tooltip like Manager: X.X.X (rejected by analyser). Apply Configuration returns: Manager version is rejected by Analyser, please update to the newest version.

Upgrade the Manager package with APT. The rejection clears on reconnect after the upgrade.

Update required vs Update recommended

The sidebar update banner uses two labels:

• Update required - Analyser is below the minimum version, or Analyser rejected the Manager version. LiveShield suspends statistics and configuration propagation until the incompatible component is upgraded.

• Update recommended - one or more components are behind the latest APT package, but all versions are mutually compatible. Operation is not blocked.

When both conditions apply to the same component, the tooltip shows the incompatibility message rather than the APT running → available line. If everything is current and compatible, the banner is hidden.

Upgrading to Manager 1.3.0

Manager 1.3.0 requires Analyser 1.3.1 or newer. Upgrade Analyser as part of the rollout and confirm that Manager shows no Update required warning before applying configuration.

Review existing Operator and Viewer accounts under Preferences > Users. Access is now assigned separately for Prefixes, Advanced Filtering Profiles, Prefix Templates, Blackholing Profiles, and Event Pipelines. Assign the resources each user needs; a prefix assignment does not grant access to all supporting resources.

Use SuperOperator for users who need unrestricted Filtering and Manual Rules management without administrative Settings or Users access. Additional Create and Delete permissions can be granted to scoped accounts. See Account management for the distinction between role permissions and resource assignments.

Explore the new Dashboard, Manual rules, and Public API guides after upgrading.

Changelog

Worker

1.3.3 (24 September 2026)

• CHANGED NIC ports are properly shut down on application exit.

• CHANGED DPDK version updated to 25.11.2.

• CHANGED Refactored workeractions and ACL programming for better stability.

• FIXED On some systems, Worker may fail to start due to the permissions issue.

1.3.2 (31 August 2026)

• REMOVED MANA NIC support due to compatibility issues with OFED drivers.

1.3.1 (27 August 2026)

• FIXED Hugepages allocation permissions.

• FIXED Invalid NUMA memory handling when no NIC is bound to socket id 0.

1.3.0 (19 August 2026)

• ADDED New protocols: IPSEC_ESP, IPFRAG_UDP, GRE

• ADDED Ability to properly dump invalid protocol packets

• ADDED CPU architecture check during startup

• ADDED Worker actions can now be applied to any invalid protocol

• ADDED Per queue stats reporting

• CHANGED ACL building optimisations

• CHANGED Various datapath optimisations and thread performance tweaks

• CHANGED Ipstats is now fully non-blocking

• CHANGED Ipstats data is now normalised to the frame time

• CHANGED Workeractions can contain priority

• CHANGED Minimum analyser version is now 1.3.0

• FIXED Fragment matching for IPv6

• FIXED Incorrect workeraction structure for IPv6, causing invalid rules to be applied

• FIXED Misses on startup due to buffer usage issues

1.3.0 (19 August 2026)

• ADDED New protocols: IPSEC_ESP, IPFRAG_UDP, GRE

• ADDED Ability to properly dump invalid protocol packets

• ADDED CPU architecture check during startup

• ADDED Worker actions can now be applied to any invalid protocol

• ADDED Per queue stats reporting

• CHANGED ACL building optimisations

• CHANGED Various datapath optimisations and thread performance tweaks

• CHANGED Ipstats is now fully non-blocking

• CHANGED Ipstats data is now normalised to the frame time

• CHANGED Workeractions can contain priority

• CHANGED Minimum analyser version is now 1.3.0

• FIXED Fragment matching for IPv6

• FIXED Incorrect workeraction structure for IPv6, causing invalid rules to be applied

• FIXED Misses on startup due to buffer usage issues

1.2.1 (11 July 2026)

• FIXED VLAN ID incorrectly retrieved when PCP or DEI bit set.

1.2.0 (10 July 2026)

• ADDED TCP flags as a protocol (TCPACK, TCPSYNACK, TCPFIN, TCPRST, TCPPSH, TCPURG).

• ADDED Minimum worker and analyser version validation.

• ADDED “INVALID PROTOCOL” now matches any unknown protocol.

• CHANGED Internal startup and app logic in order to allow new operating modes in the future.

• CHANGED Various performance and security tweaks related to memory operations.

• CHANGED Internal analyser<>worker communication structure and message types.

• FIXED Rare startup failures due to lcore startup synchronisation issues.

1.1.5 (18 June 2026)

• FIXED Possible data corruption on analyser connections.

1.1.4 (5 May 2026)

• CHANGED Performance improvements

1.1.3 (27 March 2026)

• FIXED Very rare situation where internal ACL programming could fail, due to invalid memory initialization.

1.1.2 (22 March 2026)

• FIXED Improper traffic counters during process startup under heavy load.

1.1.1 (22 March 2026)

• FIXED Some worker-actions were not properly programmed into the classification engine

1.1.0 (19 March 2026)

• ADDED Single worker-action can now create multiple internal ACL classification rules.

• CHANGED Changed protocol pattern detection to make detection more accurate.

• CHANGED DPDK version updated to 25.11.0.

1.0.2 (05 February 2026)

• FIXED Worker-actions now properly loaded during restart in heavy loaded environments.

• ADDED Packets with IPv4 Options are now properly distinguished and marked as INVALID proto.

1.0.1 (29 December 2025)

• FIXED Package installation scripts.

Analyser

1.3.1 (24 September 2026)

• ADDED Manual rule and blackholing creation.

• ADDED Ability to redirect-to-ip (in addition to the current redirect-to-vrf).

• CHANGED GoBGP updated to 4.9.0.

• CHANGED Peer assignments (router restrictions) are now refactored and more failsafe.

• CHANGED Packet dump is now ready when it reaches max packet count even if the attack is still ongoing.

• CHANGED Minimum Manager version is now 1.3.0, Worker 1.3.3.

• CHANGED Carpet bomb attacks are now handled better, without spawning several per-ip attacks.

• CHANGED Refactored workeractions. They are now fully failsafe to worker reconnects.

• CHANGED Child prefixes can now be aggregated to the parent during carpet-bomb attacks.

• CHANGED Anti-overload logic is now more failsafe to some specific carpet-bomb attacks.

• FIXED Some flowspec rules might not be withdrawn.

• FIXED Some workeractions might not be correctly programmed.

• FIXED Advanced filtering “retry” behaving incorrectly.

• FIXED Some TCP flags might be incorrectly programmed, resulting in excessive traffic drops.

1.3.0 (19 August 2026)

• ADDED BGP session status reporting

• ADDED New protocols: IPSEC_ESP, IPFRAG_UDP, GRE

• ADDED Ability to properly dump invalid protocol packets

• ADDED Support for “upstream_name” in blackholing protocol added/removed event

• ADDED More extended logging

• ADDED CPU architecture check during startup

• CHANGED Attack detection path is now fully lock-free

• CHANGED Workeractions are now ordered (more/less specific protocol)

• CHANGED Advanced filtering is now more accurate

• CHANGED Blackholing timeout is now tied to the normal protocol thresholds to avoid blackhole route flapping

• CHANGED Minimum worker version is now 1.3.0, manager version is 1.2.2

• FIXED Blackholing stop event not fired

• FIXED Blackholing route may not be removed when multiple upstreams timeouted at the same time

• FIXED Invalid stats might be collected in multiple-worker environments

• FIXED Fragments might be inproperly constructed in BGP FlowSpec UPDATE messages which may cause undefined behaviour on the router

• FIXED Fixed null-stats insertion which caused bad looking graphs

• FIXED Redirect-to-vrf and extended ipstats queries are now properly called once per attack

1.2.1 (11 July 2026)

• FIXED Disabled advanced profile rules can cause inability to start the analyser process.

1.2.0 (10 July 2026)

• ADDED TCP flags as a protocol (TCPACK, TCPSYNACK, TCPFIN, TCPRST, TCPPSH, TCPURG).

• ADDED Minimum worker, analyser and manager version validation.

• ADDED “INVALID PROTOCOL” now generates a rule blocking all unknown protocols.

• CHANGED Internal analyser<>worker communication structure and message types.

• CHANGED Advanced filtering now checks for data consistency in the database, preventing the app from starting with invalid data.

• CHANGED FlowSpec rules for packet fragments are now fully handled (first packet, last packet, DF, etc.) and better displayed.

• FIXED Advanced filtering now works correctly for sport/dport = 0 and length = 0.

• FIXED Crashes on too long worker name. Fixed various memory-related operations.

• FIXED Summary statistics in multi-worker environments are now properly calculated.

• FIXED Very rare situation where the license may fail to load.

• FIXED Incorrect FlowSpec rule generation when prefiltering was enabled on “IP” protocol.

• FIXED Timeout was not checked when no workers were connected.

1.1.5 (18 June 2026)

• FIXED Possible data corruption on worker connections.

• FIXED Undefined behaviour in multi-worker environments.

• FIXED Invalid values printed in blackholing logs.

• CHANGED OSI layers parser is now limited to specific layers to achieve better performance.

• CHANGED pcpp parser logs are now suppressed due to the possibility of invalid L7 data.

• CHANGED TCP streams to workers and manager are now fully multithreaded.

1.1.4 (5 May 2026)

• FIXED Next-hop for IPv6 blackholing

• FIXED Upstreams sometimes not correctly loaded from database

• CHANGED Statistics collection for better attack visibility

• CHANGED Internal detection logic (edited)

1.1.3 (10 April 2026)

• FIXED Rare issue with more-specific prefix ordering, causing less-specific rules to be processed.

• FIXED IPv6 parsing in bgp session peer address.

• FIXED BGP Blackholing routes flapping when timeout set to 0.

1.1.2 (27 March 2026)

• CHANGED GoBGP version updated to 4.3.0 along with the API adjustments.

• CHANGED Improvements to the detection and mitigation time.

• CHANGED Improved fragment handling.

• FIXED Selective blackholing routes being incorrectly re-announced and stalled.

1.1.1 (22 March 2026)

• FIXED Subnet aggregation triggered incorrectly when disabled

• FIXED Subnet aggregation sometimes not timing out properly

• FIXED Attack volume not properly calculated when automatically aggregated

1.1.0 (19 March 2026)

• ADDED Support for per-subnet detection and mitigation (carpet bomb attacks).

• ADDED Automatic subnet aggregation.

• CHANGED All blackholing routes now contain configurable global community.

• CHANGED Prefiltering rules are now more accurate. Typical ports now contain src/dst pair.

1.0.6 (20 February 2026)

• FIXED DRM and Telemetry counters were not properly calculated in some cases.

• FIXED GoBGP calls will now timeout instead of hanging indefinitely if GoBGP is not responding.

1.0.5 (05 February 2026)

• CHANGED DRM and Telemetry has been reworked to use new library and properly reflect documentation.

• CHANGED Analyser now includes proper user-agent in outgoing webhook requests.

• ADDED License info is now reported to the Manager module.

• ADDED Connection with InfluxDB is now being validated during startup.

• ADDED Support for prefix templates.

1.0.4 (27 January 2026)

• FIXED Parsing new lines in SendEmailNotification action.

• FIXED Crash due to PostgreSQL connection race condition in Event Pipelines.

• FIXED Improper string handling in Event Pipelines actions.

1.0.3 (23 January 2026)

• REMOVED Filter Rules generation toggle was removed.

1.0.2 (13 January 2026)

• FIXED Regular BGP blackholing not applied when no Upstreams are configured.

1.0.1 (29 December 2025)

• FIXED Package installation scripts.

Manager

1.3.0 (24 September 2026)

• ADDED Home page Overview and Executive tabs, with time-window summaries, previous-window comparison, and remembered tab selection

• ADDED Per-user Executive dashboard settings for time-window presets and Reporting-based or custom severity thresholds

• ADDED SuperOperator role and per-user assignment of prefixes, Advanced Filtering Profiles, templates, Blackholing Profiles, and Event Pipelines

• ADDED Additional per-user Create and Delete permissions for Filtering Rules and Manual Rules, plus access summaries in Account settings

• ADDED Public API v1 with Bearer JWT authentication, token management under Settings, Swagger UI, prefix and template management, pending configuration signals, and read-only profiles, routers, and pipelines

• ADDED Manual Rules for FlowSpec filtering and blackholing

• ADDED Redirect to IP traffic diversion alongside Redirect to VRF

• CHANGED Operators and Viewers can access only assigned resources and see a simplified Overview dashboard

• CHANGED Minimum Analyser version is now 1.3.1

• CHANGED Dashboard notices explain disconnected Analyser, offline Workers, and empty attack lists

• CHANGED Refreshed buttons, dashboard tabs, attack details, sidebar, forms, and side modals

• FIXED Attacks volume filter returning incorrect attacks

• FIXED Attack details close control remains visible while scrolling; the mouse wheel over charts scrolls the page instead of zooming

• FIXED Changing a threshold protocol no longer resets other threshold values

• FIXED Thresholds on prefixes, templates, and Blackholing Profiles display in ID order

1.2.2 (19 August 2026)

• ADDED Attacks page now supports column filters (IP, protocol, duration, volume, start/end time ranges)

• ADDED BGP session status display on the main dashboard

• ADDED New protocols support: IPFRAG_UDP, GRE, and IPSec-ESP

• CHANGED TCP protocol display names (e.g. TCPACK → TCP-ACK, TCPSYNACK → TCP-SYN+ACK)

• CHANGED Minimum Analyser version is now 1.3.0

• FIXED Prefix uniqueness check when creating prefixes

• FIXED Event pipeline various fixes

• FIXED Vastly increased form and dashboard chart performance

• FIXED Charts tooltip issues

• FIXED Notification template edit showing Available Inline Variables for the previously edited template

• FIXED Created user generated password was generated wrong

1.2.1 (29 July 2026)

• FIXED Unable to allow User to Access more than ~10 prefixes

• FIXED Crash when User with allowed prefixes scope enters Attacks List

• FIXED Missing Access Control when generating Attacks CSV

• FIXED Exporting more than 20 selected Attacks to CSV from Attacks List

1.2.0 (10 July 2026)

• ADDED KSC report export to CSV and PDF for selected attacks

• ADDED Manager version rejection by Analyser - incompatible Manager versions suspend statistics and configuration propagation until upgrade and reconnect

• ADDED “Update required” indicator and red Manager version in footer when rejected by Analyser

• ADDED Component version display in sidebar and footer (Manager / Analyser / Worker), including connected Analyser version

• ADDED Sidebar “Update recommended” indicator when Manager, Analyser, or Workers are behind available APT versions

• ADDED Analyser minimum version enforcement (1.2.0) - incompatible Analysers are ignored for data exchange

• ADDED “Update required” indicator and red Analyser version in footer when below minimum

• ADDED Additional attack protocol labels (TCPACK, TCPSYNACK, TCPFIN, TCPRST, TCPPSH, TCPURG)

• CHANGED Invalid protocol display name from “INVALID” to “INVALID PROTOCOL”

• FIXED Analyser TCP socket CPU hang when clients send invalid protocol data

• FIXED Analyser TCP socket communication after protocol update

• FIXED Workers incorrectly shown as online after Analyser disconnects

• FIXED Dashboard active IPv4/IPv6 summary counts

• FIXED Charts showing dates in incorrect timezone

1.1.4 (9 June 2026)

• FIXED 405 Method Not Allowed response on some actions

1.1.3 (4 June 2026)

• FIXED rate-limiting causing false-positive 429 http errors

1.1.2 (4 June 2026)

• FIXED potential high CPU usage

1.1.1 (5 May 2026)

• ADDED Attack traffic charts in attack details. Separate for whole attack and upstreams.

• CHANGED Redesigned dashboard page

1.1.0 (19 March 2026)

• ADDED Option to set thresholds for subnets in Filtering Rules, Filtering Rule Templates and Blackholing profiles

• CHANGED Allowed for creating Blackholing Profiles thresholds when creating Blackholing Profile

• FIXED Advanced Filtering Rules sorting issue

• FIXED Filtering Rule Event Pipeline reset when using template

• FIXED Performance issues of main page charts

1.0.6 (20 February 2026)

• FIXED Occasional application crash on filtering rule threshold values inputs

1.0.5 (20 February 2026)

• ADDED Support for mobile devices

1.0.4 (05 February 2026)

• ADDED Filtering Rule templates

• ADDED Better license handling

• CHANGED Moved BGP Configuration to Devices page close to BGP Routers

• CHANGED Moved Notification Templates to Filtering Page close to Event Pipelines

• FIXED Notification Template not applying to Event Pipeline action when adding new action

• FIXED Other various UI bugs

1.0.3 (27 January 2026)

• FIXED Database max pps/Bps field types.

1.0.2 (23 January 2026)

• CHANGED Advanced Filtering Profiles were moved to Filtering tab

• CHANGED BGP Routers can be now created with multiple sessions

• REMOVED Filter Rules generation toggle in Analyser Configuration was removed as this is default and only possible behaviour now

1.0.1 (29 December 2025)

• FIXED Package installation scripts.

Helper

1.1.2 (24 September 2026)

• CHANGED SIGKILL and SIGTERM are now correctly handled and passed to the child processes.

1.1.1 (27 August 2026)

• ADDED Ability to omit NIC initialization

• FIXED Invalid hugepages grub line

• FIXED NVIDIA/Mellanox support during the NIC initialization

1.1.0 (19 August 2026)

• CHANGED Terminal handling (backspace, ctrl+h, arrows) to be more user-friendly

• FIXED /etc/liveshield files created with invalid permissions

• FIXED GoBGP capabilities unintentionally dropped

1.0.2 (27 January 2026)

• FIXED Handling exceptions status codes. Auto-restart on exception should now work properly.

1.0.1 (29 December 2025)

• FIXED Package installation scripts.

Documentation

1.1.6 (24 September 2026)

• ADDED Public API documentation.

• ADDED Manual rules documentation.

• CHANGED Updated Manager screenshots.

• CHANGED Changelog updated.

1.1.5 (31 August 2026)

• CHANGED Note about unsupported MANA NIC.

• CHANGED Changelog updated.

1.1.4 (27 August 2026)

• ADDED Notes about NVIDIA/Mellanox NICs.

• CHANGED Screenshots updated.

• CHANGED CPU cores selection examples.

• CHANGED Updated installation example.

1.1.3 (19 August 2026)

• ADDED Descriptions of the new protocols.

• CHANGED System requirements.

• CHANGED CPU cores selection explanation.

• CHANGED BGP Blackholing timeout explanation.

• CHANGED Packet dump explanation.

• CHANGED Changelog updated.

1.1.2 (29 July 2026)

• CHANGED Changelog updated.

1.1.1 (11 July 2026)

• CHANGED Documentation cache is now reduced.

• CHANGED Changelog updated.

1.1.0 (10 July 2026)

• ADDED Documentation regarding the reporting tool.

• ADDED Description of the new protocols.

• CHANGED Changelog updated.

1.0.13 (18 June 2026)

• CHANGED Changelog updated.

1.0.12 (9 June 2026)

• CHANGED Changelog updated.

1.0.11 (4 June 2026)

• CHANGED Changelog updated.

1.0.10 (4 June 2026)

• CHANGED Changelog updated.

1.0.9 (5 May 2026)

• CHANGED Screenshots updated to reflect new UI changes.

• CHANGED Changelog updated.

1.0.8 (10 April 2026)

• CHANGED Changelog updated.

1.0.7 (27 March 2026)

• CHANGED Changelog updated.

1.0.6 (22 March 2026)

• CHANGED Changelog updated.

1.0.5 (22 March 2026)

• CHANGED Changelog updated.

1.0.4 (19 March 2026)

• ADDED Subnet aggregation subsection in the “Detection and filtering” section.

• ADDED Subnet detection explanation.

• CHANGED Screenshots and descriptions updated to reflect new UI changes.

• CHANGED BGP example configurations updated to allow subnet blackholing.

• CHANGED Changelog updated.

1.0.3 (20 February 2026)

• ADDED FAQ section.

• CHANGED Changelog updated.

1.0.2 (05 February 2026)

• CHANGED Changelog updated.

• CHANGED Screenshots and descriptions updated to reflect new UI changes.

• ADDED Added “Templates” section in the “Detection and filtering”.

1.0.1 (27 January 2026)

• CHANGED Changelog updated.

1.0.0 (25 January 2026)

• Initial public documentation release.

On this page